Add comprehensive integration tests for proxy forwarding

[JoshCap20]

Summary

• Add comprehensive integration tests covering the full proxy TCP lifecycle
• Split into proxy_integration.rs (SSRF protection, health check) and proxy_forwarding.rs (HTTP/HTTPS forwarding, requires _test-support feature)
• Add proxy_server.rs for production server behaviors (timeout, connection limiting)
• Add _test-support cargo feature with SSRF bypass mechanism so forwarding tests can use localhost upstreams
• Extract handle_connection to lib.rs as a single source of truth — main.rs and all test helpers call the same code path
• Extract shared read_upstream_body helper for DRY test upstream servers
• Rewrite malformed_request.rs to use shared test helpers

Closes

Closes #36
Closes #37
Closes #38
Closes #39

Test coverage added

Test	What it covers
test_ssrf_bypass_active	Verifies SSRF bypass mechanism works
test_ssrf_bypass_not_active_in_integration_tests	Guards against accidental bypass leakage
test_http_get_forwarding	Full GET → upstream → response
test_http_post_with_body	POST with Content-Length body forwarding
test_http_response_headers_forwarded	Custom response headers passed through
test_http_hop_by_hop_headers_stripped_and_others_forwarded	Proxy-Authorization stripped, X-Keep forwarded
test_health_check_returns_200	Relative /health intercepted by proxy
test_health_check_not_intercepted_for_absolute_url	Absolute URL /health forwarded to upstream
test_http_ssrf_block_private_address	403 for 127.0.0.1
test_connect_ssrf_block_private_address	403 for CONNECT to 127.0.0.1
test_http_ssrf_block_localhost	403 for localhost
test_connect_handler_ssrf_blocks_private	Handler-level SSRF block
test_http_502_on_closed_port	502 for unreachable upstream (deterministic)
test_connect_502_on_closed_port	502 for CONNECT to closed port
test_connect_tunnel_bidirectional	Full CONNECT tunnel with echo server
test_proxy_handles_multiple_sequential_requests	3 sequential requests through one proxy
test_proxy_handles_concurrent_requests	10 simultaneous requests via tokio::spawn
test_http_post_large_body	128 KiB body forwarded correctly
test_http_post_chunked_transfer_encoding	Chunked body reassembly end-to-end
test_connection_timeout_closes_idle_connection	Partial request triggers EOF after timeout
test_connection_limit_rejects_excess	Excess connections get EOF
test_connection_limit_recovers_after_completion	Permits released after connection completes

Architecture

lib.rs::handle_connection()     ← single source of truth
    ├── main.rs                 ← thin wrapper (stream split + timeout + semaphore)
    ├── tests/common/mod.rs     ← test proxy calls handle_connection(None)
    │   ├── start_proxy / start_proxy_with_timeout / start_proxy_with_limit
    │   ├── start_upstream / start_looping_upstream
    │   ├── send_raw / read_upstream_body
    ├── tests/proxy_integration.rs  ← SSRF + health check (always runs)
    ├── tests/proxy_forwarding.rs   ← forwarding tests (behind _test-support)
    ├── tests/proxy_server.rs       ← timeout + connection limiting (always runs)
    └── tests/malformed_request.rs  ← uses shared helpers

How to run

# Basic tests (always work)
cargo test

# Full suite including forwarding tests
cargo test --features _test-support

Test plan

• cargo test --features _test-support passes (92 tests)
• cargo fmt -- --check clean
• cargo clippy --features _test-support -- -D warnings clean
• Zero compiler warnings

🤖 Generated with Claude Code